Idempotency-Key on a POST Endpoint

Add an Idempotency-Key to a POST that creates a charge or a resource. A retry must not create a second one. ENDPOINT What it creates: [RESOURCE] Side effects: [DB ROW, EMAIL, PAYMENT] Key header: Idempotency-Key Who supplies it: [CLIENT] Storage: [POSTGRES] TTL: [24H] DELIVER 1) The table: key, user id, request hash, response status, response body, created_at, locked_at. 2) The flow: insert the key, if conflict and the hash matches, return the stored response; if the hash differs, 422; if another request is in progress, 409 with a retry hint. 3) What is hashed: the semantic body, not volatile fields. List which fields are excluded. 4) When we store the response: after the side effect commits. What we do if we crash between the side effect and the store (the dangerous window) and how the unique constraint on the business object saves us. 5) Tests for retry, mismatched body, and parallel requests. Do not use the key as the only auth. Scope it to the authenticated user.